Specification-based anomaly detection

• US 20040098617A1
• Filed: 11/18/2002
• Published: 05/20/2004
• Est. Priority Date: 11/18/2002
• Status: Active Grant

• Current Assignee: The Research Foundation for The State University of New York (State University of New York)
• Original Assignee: The Research Foundation for The State University of New York (State University of New York)
• Inventors: Sekar, Ramasubramanian
• Granted Patent: US 7,370,357 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 69/03 Protocol definition or specification protocol conformance testing H04L1/244

Abstract

A method for network intrusion detection on a network comprising a plurality of state machines for passing a plurality of network packets comprises determining frequency distributions for each transition within each state machine, determining the distributions of values of each state machine on each transition, and comparing the distributions to observed statistics in the network, and upon determining that the observed statistics are outside defined limits, detecting an anomaly.

Claims

1. A method for network intrusion detection on a network comprising a state machines for processing a plurality of network packets comprising the steps of:

determining a state-machine specification for at least one network protocol of interest;

determining at least one statistical property of interest, wherein each statistical property of interest is associated with a property of the state-machine;

determining, in a training mode, statistics corresponding to the at least one statistical property of interest;

initializing a detection mode with the statistics corresponding to the at least one statistical property of interest;

determining observed statistics corresponding to the at least one statistical property of interest in the detection mode according to network packets processed by the state-machines; and

comparing the at least one statistical property of interest to the observed statistics corresponding to the at least one statistical property of interest determined in detection mode, and upon determining a significant deviation generating an alarm.

2. The method of claim 1, further comprising storing statistics corresponding to the at least one statistical property of interest determined in training mode.

3. The method of claim 1, wherein the at least one network protocol of interest is one of IP, TCP, and HTTP.

4. The method of claim 1, wherein the at least one statistical property of interest is a frequency distribution with which a transition is taken.

5. The method of claim 1, wherein the at least one statistical property of interest is a distribution of a value of at least one state variable.

6. The method of claim 1, wherein the alarm further comprises at least one packet field of the network packet and state machine contents.

7. The method of claim 1, further comprising the steps of:

determining a source of an attack, wherein the attack triggered the alarm;

determining a destination of the attack; and

determining a type of the attack.

8. The method of claim 1, wherein the at least one statistical property of interest is one of whether a particular transition on the state machine is taken by the trace and the value of the particular state variable or a packet filed when a transition is traversed by a trace.

9. The method of claim 1, wherein the state-machine specification is rule based.

10. A method for network intrusion detection on a network comprising a plurality of state machines for passing a plurality of network packets comprising the steps of:

determining frequency distributions for each transition within each state machine;

determining the distributions of values of each state machine on each transition; and

comparing the distributions to observed statistics in the network, and upon determining that the observed statistics are outside defined limits, detecting an anomaly.

11. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for for network intrusion detection on a network comprising a plurality of state machines for passing a plurality of network packets, the method steps comprising:

determining frequency distributions for each transition within each state machine;

determining the distributions of values of each state machine on each transition; and

comparing the distributions to observed statistics in the network, and upon determining that the observed statistics are outside defined limits, detecting an anomaly.